Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

ExecBro

NPM · EXECBRO · SCANNED AUG 3

Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots

Available components

67 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security71
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (140 of 144), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to igorzheludkov/execbro). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability52
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 18851 tokens (~325/item across 58 items; 58 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management5
  • Stability check failed: the tool surface changed between 2.2.0 and 2.5.0: 1 tool removals, 0 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · execbro

# add to Claude Code
claude mcp add com-execbro-execbro -- npx -y execbro
# add to Codex CLI
codex mcp add com-execbro-execbro -- npx -y execbro
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-execbro-execbro": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "execbro"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-execbro-execbro --command npx --arg -y --arg execbro
# ~/.hermes/config.yaml
mcp_servers:
  com-execbro-execbro:
    command: "npx"
    args: ["-y", "execbro"]
// mcp.json
{
  "mcpServers": {
    "com-execbro-execbro": {
      "command": "npx",
      "args": [
        "-y",
        "execbro"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 −2

    No change was recorded against any check on this day. Supply Chain Security went from 81 to 71. Other categories moved too: Stability & Change Management rose 3.

  • 2 Aug 26 −2
    • Stability: unverified → fail security
    • Provenance: pass → unverified security
    • Install scripts: pass → unverified security
    • Known CVEs: fail → unverified security
    • Provenance: pass → fail security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • The attested source repository moved: igorzheludkov/execbro security
    • The attested source repository moved: igorzheludkov/execbro security
    • Capabilities: pass → unverified functional
    • License: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Maintenance: pass → unverified functional
    • Dependency health: partial → unverified functional
    • License: pass → fail functional
    • First check of Schema quality: unverified functional
    • Schema quality: excellent → good functional
    • Licence: MIT functional
    • Licence: MIT functional
    • Package version: 2.2.0 → 2.5.0 functional
    • Package version: 2.2.0 → 2.4.0 functional
    • Package version: 2.2.0 → 2.3.0 functional
  • 1 Aug 26 71

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
igorzheludkov/execbro
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/igorzheludkov/execbro/.github/workflows/publish.yml@refs/tags/v2.5.0
Rekor log index:
2327182441
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:f6f8fdfc6ddb1ce480b3b436c026a019e7fc6a23ed919007906e3f9fea63e653ab0016b3d8ea84ed22a51ee2a87dbfd0c433a3fc8541e993111d6e460
Discovery method:
attestation_endpoint
Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj high yes
Dependencies 140 packages

140 packages in the resolved dependency tree · 129 deprecated · 30 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 58 exposed · ~18,572 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
redux_get_state ~273

Read state from the Redux store bound to the app's <Provider>, resolved live via the fiber tree (same store redux_dispatch targets). PURPOSE: Inspect the current app state without relying on __RN_AI_DEVTOOLS__.stores.redux (which may point at a different store instance than the Provider). WHEN TO USE: Verify state shape before/after redux_dispatch, or check what slice keys exist before crafting an action. WORKFLOW: redux_get_state() -> craft action -> redux_dispatch -> redux_get_state({ path: 'app' }) to confirm. LIMITATIONS: Requires React DevTools hook (dev mode). State must be JSON-serializable; non-serializable values are replaced with an error marker. GOOD: redux_get_state({ path: 'app' }) BAD: redux_get_state({ path: 'app.isLoading.0' }) when isLoading is a boolean — path traversal returns undefined.

NameTypeReqDescription
devicestringRN device name (substring). Omit for default; see get_apps.
pathstringOptional dotted path into state (e.g. 'app' or 'auth.user'). Omit for the full state.
storeIndexintegerIndex of the Provider store to read from when the app has multiple <Provider> roots (default: 0).

No output schema declared.

No examples provided.

reload_app ~343

Reload the React Native app (triggers JavaScript bundle reload like pressing 'r' in Metro). PURPOSE: Force a full JS bundle reload when Fast Refresh isn't enough — clears in-memory state and re-runs the bundle from scratch. WHEN TO USE (only these cases): (1) native code, app.json, Info.plist, Podfile, or a native module changed; (2) Fast Refresh visibly failed (red-screen or stale render confirmed via screenshot after a few seconds); (3) the app is in a broken state; (4) you need to reset app state completely; (5) the user explicitly asks. AVOID: reloading reflexively after JS/TS/TSX/style edits — Fast Refresh applies those in 1-2s. A reload discards navigation stack, context, hooks state, BLE/WebSocket connections, paired devices, and auth sessions, which can force re-pairing or re-login and break your verification loop. WORKFLOW: screenshot → wait 2s for Fast Refresh → if still stale, reload_app. Auto-connects to Metro if no connection exists (with or without a device argument) — no need to call scan_metro first. After reload, wait a few seconds before running other tools. SEE ALSO: get_refresh_status (did Fast Refresh accept?), get_bundle_status (did Metro compile?).

NameTypeReqDescription
devicestringTarget device name, substring match against the name shown by get_apps (a simulator UDID or adb serial also works). OMIT THIS unless several devices are connected — passing a name copied from list_de…

No output schema declared.

No examples provided.

scan_metro ~226

Scan for running Metro bundler servers and automatically connect to any found React Native apps. This is typically the FIRST tool to call when starting a debugging session - it establishes the connection needed for other tools like get_logs, list_debug_globals, execute_in_app, and reload_app. PURPOSE: Discover Metro on ports 8081-8090 and auto-connect all React Native debugger targets it advertises. WHEN TO USE: At the start of any session, or after the user restarts Metro / boots a new simulator. WORKFLOW: scan_metro -> get_apps -> get_logs / ios_screenshot / tap. GOOD: scan_metro() BAD: scan_metro() called repeatedly in a loop — use ensure_connection to re-verify an existing connection.

NameTypeReqDescription
endPortnumberEnd port for scanning (default: 8090). Metro allocates upward from 8081, so ten ports covers several apps side by side; widen only if your bundler is pinned elsewhere.
startPortnumberStart port for scanning (default: 8081)

No output schema declared.

No examples provided.

search_logs ~242

Search console logs for text (case-insensitive). PURPOSE: Find log lines matching a substring across the connected app's console buffer. WHEN TO USE: User reports a known error/warning, or wants to trace a specific event (e.g., "redux", "auth failed"). For unfocused exploration, prefer get_logs. WORKFLOW: scan_metro -> search_logs(text="...") -> if empty, get_logs to verify buffer populated. LIMITATIONS: Only matches text captured AFTER the app connected; won't find pre-connect logs. GOOD: search_logs({ text: "TypeError" }) BAD: search_logs({ text: "" }) (use get_logs for a raw dump)

NameTypeReqDescription
devicestringRN device name (substring). Omit for all devices; see get_apps.
maxMessageLengthnumberMax characters per message (default: 500, set to 0 for unlimited)
maxResultsnumberMaximum number of results to return (default: 50)
textstringyesText to search for in log messages
verbosebooleanDisable all truncation and return full messages

No output schema declared.

No examples provided.

search_network ~249

Search network requests by URL pattern (case-insensitive). PURPOSE: Filter the network buffer to requests whose URL matches a substring — fast way to find a specific endpoint in a noisy app. WHEN TO USE: You know part of the URL (e.g., "/graphql", "users", a domain) and want matching requests across all devices. WORKFLOW: search_network(urlPattern="/api/") -> get_request_details(requestId="...") for full headers/body. LIMITATIONS: Matches URL only; for method/status/body filtering use get_network_requests. Bodies are only present when the SDK is installed. GOOD: search_network({ urlPattern: "/graphql" }) BAD: search_network({ urlPattern: "" }) — empty pattern matches everything; use get_network_requests instead.

NameTypeReqDescription
devicestringRN device name (substring). Omit for all devices; see get_apps.
maxResultsnumberMaximum number of results to return (default: 50)
urlPatternstringyesURL pattern to search for. Also matches GraphQL operation names (e.g. "GetCharacters") — use the operation name to find one GraphQL call among many sharing the same endpoint.

No output schema declared.

No examples provided.

send_feedback ~304

Report feedback about the ExecBro MCP tools THEMSELVES — a tool (tap, get_screen_layout, get_logs, etc.) that behaved incorrectly, was confusing, was missing, or could work better. This is EXCLUSIVELY about your experience operating ExecBro's debugging tools. It is NOT for bugs in the user's app under test, and NOT for the feature or task you were working on in this session — keep that out of the report entirely. Auto-collects environment info. Returns a pre-filled GitHub issue URL and formatted issue body. Ask the user to open the URL and paste the body to submit.

NameTypeReqDescription
descriptionstringyesWhat about ExecBro's tools went wrong or could be better: which tool, what you expected it to do, what it actually did. Do NOT describe the app feature or task you were debugging — only the tool's be…
titlestringyesShort summary of the ExecBro tooling issue (becomes the GitHub issue title)
typestringyesType, scoped to ExecBro tooling: "bug" = an ExecBro tool malfunctioned, "feature_request" = a missing ExecBro capability, "feedback" = general notes on using the ExecBro tools
workflow_contextstringWhich ExecBro tools were in use when the issue surfaced (e.g. "tap → get_screen_layout retry loop"). Name the tools and the debugging step — not the user's app goal.

No output schema declared.

No examples provided.

swipe ~792

Swipe gesture that auto-routes to the correct platform (iOS or Android), with pixel-diff verification. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified swipe entry point. Easiest form: swipe({ direction: "up" }) scrolls to reveal more content ("down"/"left"/"right" also work; bare swipe() defaults to "up"). Optional distance in screenshot pixels (default 33% of axis). For precise control, pass all four coordinates (startX/startY/endX/endY) — they take precedence over direction. WHEN TO USE: Scrolling lists, paging carousels, pull-to-refresh, dismissing sheets, opening drawers — anything that needs a gesture rather than a tap. Especially useful in virtualized lists (FlatList/SectionList) where off-screen items aren't mounted in the fiber tree. VERIFICATION: verify=true (default) returns `verification.meaningful` — false means the scroll did nothing (end-of-list, non-scrollable surface, or missed coordinates). burst=true catches transient feedback like overscroll bounce. WORKFLOW: swipe({ direction: "up" }) -> read response.verification.meaningful. Advanced: pass startX/startY/endX/endY for coordinate-precise gestures. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB. Pass `device` to target a specific simulator/emulator when multiple are available — call list_devices for the inventory.

NameTypeReqDescription
burstbooleanCapture rapid sequential frames after the swipe to detect transient feedback (overscroll bounce, fling-then-snap-back) even when the final state is unchanged. Frames are stored in the image buffer; u…
deltanumberiOS only — touch step size between events (driver-dependent default). Ignored on Android.
devicestringTarget device. Accepts (a) an iOS simulator UDID, (b) an Android adb serial like 'emulator-5554', (c) the iOS simulator or Android emulator/device name (substring match), or (d) a connected RN app's…
directionstringShorthand for a centered scroll gesture (content-scroll semantics): "up" reveals content below (finger moves bottom→top), "down" reveals content above, "left"/"right" page horizontally. A bare swipe(…
distancenumberTravel length in screenshot pixels for the direction shorthand. Default: 33% of the relevant screen axis.
durationMsnumberSwipe duration in milliseconds (default: 300 on Android; iOS uses driver default if omitted)
endXnumberEnding X coordinate in screenshot pixels (explicit-coordinate mode)
endYnumberEnding Y coordinate in screenshot pixels (explicit-coordinate mode)
screenshotbooleanReturn the post-swipe image bytes in the response. Default true. Set to false to drop the PNG bytes — verification still runs (set verify=false to skip that too).
startXnumberStarting X coordinate in screenshot pixels (explicit-coordinate mode)
startYnumberStarting Y coordinate in screenshot pixels (explicit-coordinate mode)
verifybooleanCompare before/after screenshots to detect whether the swipe produced a visual change. Set false to skip. When skipped, the response contains `verification: { skipped: true, skippedReason }` so calle…

No output schema declared.

No examples provided.

tap ~927

Tap a UI element. Automatically tries multiple strategies: fiber tree (React), accessibility tree (native), and OCR (visual). [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified tap entry point — resolves text/testID/component/coordinates into a real touch event on the correct device. WHEN TO USE: Any time you need to press a button, focus an input, open a menu, or verify a handler fires. Prefer testID, then text, then component, then (x,y) from a screenshot's pressables list. WORKFLOW: ios_screenshot or android_screenshot -> tap(testID="...") | tap(text="...") | tap(x, y) -> screenshot again to verify. Use burst=true when meaningful=false but visual feedback looks transient. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB for accessibility/coordinate taps. Non-ASCII text skips fiber (Hermes); prefer testID. Pass `device` to target a specific simulator/emulator when multiple are available — call list_devices for the inventory. GOOD: tap({ testID: "login-btn" }); tap({ text: "Submit" }); tap({ x: 300, y: 600 }); tap({ x: 300, y: 600, native: true, device: "emulator-5554" }) BAD: tap({ text: "" }) or tap({ x: 0, y: 0 }) — missing a target. tap({ text: "Submit" }) without first screenshotting an ambiguous screen. SOURCE: need the file:line that renders an element? inspect_at_point(x, y).

NameTypeReqDescription
burstbooleanEnable burst screenshot capture for enhanced verification. Captures 4 rapid screenshots (~150ms intervals) after the tap to detect transient visual feedback (press animations, highlights, ripples) th…
componentstringComponent name match (case-insensitive substring, e.g. 'Button', 'MenuItem').
devicestringTarget device. Accepts (a) an iOS simulator UDID, (b) an Android adb serial like 'emulator-5554', (c) the iOS simulator or Android emulator/device name (substring match), or (d) a connected RN app's…
indexnumberZero-based index when multiple elements match (default: 0).
maxTraversalDepthnumberMax parent levels to traverse when searching by component name (default: 15). Increase if your component is deeply wrapped (e.g. inside multiple HOCs/animation wrappers).
nativebooleanWhen true, tap coordinates directly via ADB/simctl without requiring a React Native connection. Useful for interacting with native UI, system dialogs, or non-RN apps. Requires x/y coordinates.
screenshotbooleanReturn post-tap image bytes in the response. Default true. Set to false to drop the PNG bytes — verification still runs (set verify=false to skip that too). Combine with verify=true to get the meanin…
strategystring"auto" (default) tries fiber -> accessibility -> OCR. Set explicitly to skip strategies you know will fail.
testIDstringExact match on the element's testID prop.
textstringVisible text to match (case-insensitive substring). ASCII only for fiber strategy; OCR handles non-ASCII.
verifybooleanRun before/after screenshot diff to detect if the tap had a meaningful visual effect. Default: true for coordinate/accessibility/ocr strategies, false for fiber. Independent of `screenshot` — verify…
xnumberX coordinate in pixels (from screenshot). Must provide both x and y.
ynumberY coordinate in pixels (from screenshot). Must provide both x and y.

No output schema declared.

No examples provided.